AcquireTokenForManagedIdentityParameterBuilder Class

Executes the Token request asynchronously.

Executes the Token request asynchronously, with a possibility of cancelling the asynchronous method.

Validates the parameters of the AcquireToken operation.

Adds a claims challenge to the token request. The SDK will bypass the token cache when a claims challenge is specified. Retry the token acquisition, and use this value in the WithClaims(String) method. A claims challenge typically arises when calling the protected downstream API, for example when the tenant administrator revokes credentials. Apps are required to look for a 401 Unauthorized response from the protected api and to parse the WWW-Authenticate response header in order to extract the claims. See https://aka.ms/msal-net-claim-challenge for details.

Sets the correlation id to be used in the authentication request. Used to track a request in the logs of both the SDK and the Identity Provider service. If not set, a random one will be generated.

Sets Extra Query Parameters for the query string in the HTTP authentication request.

Sets Extra Query Parameters for the query string in the HTTP authentication request with control over which parameters are included in the cache key

Specifies if the client application should ignore access tokens when reading the token cache. New tokens will still be written to the application token cache. For MSI v2 mTLS requests, this also bypasses the cached binding certificate and mints a new certificate. By default the token is taken from the application token cache (forceRefresh=false)

Adds a key-value pair to the token cache key without sending it as a query parameter. Use this to partition cached tokens (e.g., isolating short-lived sessions from regular sessions for the same user). Both AcquireTokenByAuthorizationCode and AcquireTokenSilent must use the same partition key to match cached entries.

Adds a key-value pair to the token cache key without sending it as a query parameter. Use this to partition cached access tokens (e.g., isolating short-lived sessions from regular sessions for the same user). Both AcquireTokenByAuthorizationCode and AcquireTokenSilent must use the same partition key to match cached entries.

Enables mTLS Proof-of-Possession for managed identity token acquisition with additional PoP options, such as a minimum required binding strength. When attestation is required (KeyGuard scenarios), use the Msal.KeyAttestation package and call .WithAttestationSupport() after this method.

Enables mTLS Proof-of-Possession for managed identity token acquisition. When attestation is required (KeyGuard scenarios), use the Msal.KeyAttestation package and call .WithAttestationSupport() after this method.

Registers a delegate that adds additional tags (dimensions) to the OpenTelemetry metrics MSAL emits for this managed identity token acquisition. The delegate is invoked while MSAL records its metrics and receives the ExecutionResult of the acquisition (indicating success or failure, with the result or exception) together with a mutable list of tags. Tags appended to that list are attached to every metric recorded for the request, including metrics emitted during proactive background refresh.

Uses the IMDSv2 attested flow (Credential Guard–issued certificate over mTLS) to acquire a standard bearer token. The mTLS certificate authenticates the connection to the ESTS token endpoint, but the returned token carries token_type=bearer and has no binding certificate in the AuthenticationResult. Requires Windows Credential Guard (VBS) to be enabled on the host. When attestation is required, call .WithAttestationSupport() (from the Microsoft.Identity.Client.KeyAttestation package) after this method.